Permissions and Authentication Explained

About this document


Pandectes GDPR Compliance helps your store meet privacy, consent, and accessibility obligations across different regions of the world. To do this, the app requests a defined set of Shopify permissions, known as access scopes.


This document explains, in plain language, every permission the app requests: what Shopify uses each permission for, and how Pandectes uses it. It then describes how the app is installed and authenticated, why permissions are configured the way they are, and how you can verify for yourself how those permissions are used.


The goal is full transparency. Nothing here requires any technical knowledge of how the app is built; it simply explains what we ask for and why.



How Pandectes handles your data


Before the individual permissions, it helps to understand a principle that applies across the entire app:


  • No internal storage of your customer or order data. Pandectes does not keep your customers' or orders' data in its own database.
  • Lookups, not copies. Where a feature needs to verify something (for example, confirming that an email address belongs to a customer, or that an email and order ID match a real order), Pandectes performs a lookup through its app servers and uses only the result of that check.
  • Persistence stays inside Shopify. When a record genuinely needs to be saved (such as a logged EU withdrawal request), it is written back into Shopify's own storage and linked to the relevant order, rather than being stored by Pandectes.


This data-minimisation approach is the reason several permissions below are described as "lookups only."



How Pandectes is installed and authenticated


Pandectes uses Shopify managed installation, the modern method that Shopify recommends for installing apps and keeping their permissions up to date.


With managed installation, Shopify itself handles installing the app and applying any permission changes, without sending you through extra authorization screens. For you, this means faster, smoother installs and updates, with no page redirects, no flickering screens, and no repeated consent prompts. Behind the scenes, the app obtains short-lived access tokens through Shopify's secure token exchange rather than older redirect-based flows.


A defining characteristic of managed installation is that an app declares the complete set of permissions it may use in a single, central configuration that it submits to Shopify. Shopify then applies that configuration consistently to every store that installs the app. Pandectes does not, and under this model cannot, request a different, hand-picked set of permissions for each individual store.


Why permissions are declared centrally


This is a deliberate architectural decision, and it works in your favour in several ways:


  • One consistent, auditable configuration. Every store runs Pandectes with the same reviewed set of permissions. There are no per-store variations to track, which keeps the app's behaviour predictable and easy for you, for Pandectes, and for Shopify to reason about.
  • Instant feature activation, with no friction. Pandectes is modular: the cookie banner, accessibility widget, Data Subject Requests, Do Not Sell My Data, and the EU Withdrawal Button can each be switched on or off at any time. Because the necessary permissions are already in place, turning on a module works immediately: no reinstallation, no new authorization screen, and no interruption to your storefront.
  • A permission granted is not a permission used. Being granted a permission only means the app may use it, if and when you enable the related feature. A permission that belongs to a module you have not turned on simply remains dormant. Combined with the data-minimisation principle above, this means Pandectes reads or writes only what an active feature actually needs.


So if, for example, you have not enabled the EU Withdrawal Button, the order-related permissions associated with it stay unused until you choose to enable that feature.


Reviewed and validated by Shopify


The set of permissions Pandectes requests is not chosen arbitrarily, and it cannot be quietly changed. Every permission is reviewed and confirmed by Shopify in the context of two programs that Pandectes takes part in:


  • Shopify Plus Partner. Pandectes is a recognised Shopify Plus Partner, a status Shopify grants to vetted, established partners that meet its standards for quality, expertise, and trust.
  • Built for Shopify. Pandectes GDPR Compliance holds the Built for Shopify designation, Shopify's highest level of app recognition, awarded only to apps that meet its strict requirements for quality, performance, security, and responsible handling of data.


Because Pandectes participates in both programs, the permissions described in this document have been examined and validated by Shopify against its own published standards, and any change to what the app requests is subject to the same review. In short, the access Pandectes asks for is held to Shopify's standards rather than set at Pandectes' sole discretion, ensuring all applicable standards are met.


You can verify how permissions are used


Shopify provides a management screen for every installed app in your store's admin. From there you can review the exact permissions Pandectes has been granted and see whether each one has actually been used, including whether a given permission has ever been used on your store. Because this is the clearest way to confirm that the app's real-world access matches what is described here, the section "Understanding Shopify's 'Manage app' screen" below walks through exactly what it shows and how it maps to the permissions in this document.



Permissions Pandectes requests


Below is every permission Pandectes requests, grouped by purpose. For each one you'll find Shopify's own definition of the permission alongside an explanation of how Pandectes uses it.


A note on "write" permissions: On Shopify, a write_ permission generally also grants the matching read access for the same resource. This is why you may not see separate "read" permissions for content, files, themes, or metaobjects: the corresponding write permission already covers reading them. In places where Pandectes only needs to read a resource (for example, checking your theme.liquid), it does so without modifying anything.



These permissions let the cookie banner apply the correct consent behaviour and pass consent signals to your other tools.


write_privacy_settings
Shopify's definition. Access to the store's privacy settings and cookie banner configuration (PrivacySettings, CookieBanner).


How Pandectes uses it. Configures your store's regional privacy settings, defining which regions of the world require consent and which do not. This is essential for the cookie banner to behave correctly in each region, so that the appropriate rules (such as the GDPR in the EU/EEA and the CPRA/CCPA in California) are applied to every visitor.


write_pixels
Shopify's definition. Access to the Web Pixels API for creating and managing a web pixel.


How Pandectes uses it. Registers Web Pixels that allow Pandectes integrations, such as Google Consent Mode, to operate consistently across the entire customer journey: the storefront (pre-checkout), the checkout, and the post-checkout "thank you" page.


Group 2: Placing Pandectes on your storefront


These permissions let the app add its features to your store and deliver supporting assets, while staying within Shopify's recommended methods.


write_content
Shopify's definition. Access to online-store content such as Pages, Blogs, Articles, and Comments.


How Pandectes uses it. Creates the storefront pages that host the app's blocks, such as the Cookie Declaration, Data Subject Request, Do Not Sell My Data, and EU Withdrawal pages, so you don't have to create and wire them up by hand.


write_files
Shopify's definition. Access to generic Files in the store's file storage.


How Pandectes uses it. Uploads supporting assets to your store's Files area so they are delivered through Shopify's CDN, which is fast and highly resilient. These assets include the logos used in the cookie banner and accessibility widget, and the pandectes-rules.js file that holds the rules for the Pandectes auto-blocker.


write_themes
Shopify's definition. Access to online-store theme files and assets (OnlineStoreTheme).


How Pandectes uses it. Used in a deliberately limited way. On modern stores it primarily reads your theme.liquid to detect whether the cookie banner and accessibility widget app embeds are enabled, and it is used to clean up assets that older versions of the app previously added to the theme. In keeping with Shopify's Built for Shopify program, which Pandectes participates in, the app no longer creates, modifies, or deletes theme assets.


write_script_tags
Shopify's definition. Access to ScriptTag objects, which load scripts on the storefront.


How Pandectes uses it. Maintained primarily for compatibility. On older "vintage" themes that do not support Online Store 2.0, script tags are the only available way to add the storefront code the app needs. On modern stores, Pandectes delivers its cookie banner and accessibility widget through app embeds (Shopify's recommended method), so in practice this permission is now used mainly to remove legacy script tags and replace them with app embeds when a store is migrated. As with theme assets, the Built for Shopify program does not allow apps to add script tags, so on modern stores Pandectes does not create them; this permission serves legacy compatibility and cleanup only.


Group 3: Privacy-rights modules (Data Subject Requests and EU Withdrawal)


These permissions support the features that let your shoppers exercise their rights. The data here is looked up, not stored by Pandectes; where a result must be saved, it is written back into Shopify.


read_customers
Shopify's definition. Access to customer records and related Segment, Company, and Company Location data.


How Pandectes uses it. Powers the Data Subject Requests (DSR) module. When a visitor exercises a privacy right, whether the right of access and data portability, the right to rectification, or the right to erasure ("right to be forgotten"), Pandectes looks up the email address they provide to confirm whether it belongs to a customer of your store, before starting the verification process. The module is available both as an app block you can add to any page and as a customer-account extension shown in the customer accounts area when you enable it. These are lookups only; Pandectes does not store this customer data.


read_orders
Shopify's definition. Access to Orders, Fulfillments, Order Transactions, and Abandoned Checkouts (by default, those from the last 60 days).


How Pandectes uses it. Powers the EU Withdrawal Button. A shopper who wishes to withdraw from a purchase enters their email address and order ID, and Pandectes verifies that this combination matches a real order before allowing the withdrawal request to proceed.


read_all_orders
Shopify's definition. Extends order access beyond Shopify's default 60-day window. This permission is granted only after a dedicated Shopify review and is used together with read_orders.


How Pandectes uses it. Extends the EU Withdrawal Button so it can also verify orders placed more than 60 days ago, since withdrawal rights can apply to older purchases. It only widens the time range of the same order verification described above and does not introduce any new use of order data.


write_metaobject_definitions
Shopify's definition. Access to create and modify metaobject definitions, which describe the structure of a metaobject.


How Pandectes uses it. Defines the data structure used by the EU Withdrawal Button, specifically the schema for recording that a withdrawal or return has been requested for an order. Establishing this structure is what allows the request to be stored natively within Shopify and associated with the relevant order.


write_metaobjects
Shopify's definition. Access to create and modify metaobject records that follow the defined structure.


How Pandectes uses it. Creates the individual records based on the definition above. When a shopper completes a withdrawal request, Pandectes records it as a metaobject linked to the order, signalling within Shopify that a withdrawal or return was requested. As with all Pandectes data, this is stored in Shopify, not in a Pandectes database.



Understanding Shopify's "Manage app" screen


Shopify shows a "Manage app" screen for every installed app in your admin, and it is the most direct way to verify what Pandectes can access and what it has actually used. The screen groups the app's access under Shopify's own high-level labels, which map directly to the permissions described earlier in this document.


Activity and permissions vs. unused access


Shopify separates the app's access into two lists:


  • Activity and permissions: areas the app has recently used, along with when they were last used.
  • Unused access: areas the app can access but has not used in the last 30 days.


Which areas appear in each list depends on the Pandectes features you have enabled. This is the "a permission granted is not a permission used" principle made visible: a permission tied to a feature you haven't turned on simply sits under Unused access. For example, a store that has not activated the Data Subject Requests or EU Withdrawal modules will typically see the Customers and Orders areas (and, if no pixel-based integration is active, Store analytics) listed as unused.


The table below maps each area label Shopify shows to the underlying Pandectes permissions:


Area shown in Shopify

Access

Underlying Pandectes permission(s)

Online Store

View & Edit

write_content, write_script_tags, write_themes

Shopify admin

View & Edit

write_files, write_privacy_settings

Custom data

View & Edit

write_metaobject_definitions, write_metaobjects

Customers

View only

read_customers

Orders (All order history)

View only

read_orders, read_all_orders

Store analytics

View & Edit

write_pixels


The "All order history" label shown next to Orders reflects the read_all_orders permission, which allows the EU Withdrawal Button to verify orders older than Shopify's default 60-day window.


Privacy: the personal data this app can access


The same screen lists the categories of personal data the app can access, and Shopify displays a confirmation here that Pandectes meets its data-handling and privacy requirements.


Under Customers, you will see two categories:


  • Sensitive data (Name and Email address). These are used by the Data Subject Requests and EU Withdrawal Button modules and come from the read_customers permission. This is data Pandectes explicitly requests, because verifying a shopper's identity is essential to those rights-based features. As noted earlier, the data is looked up, not stored by Pandectes.
  • Device and activity data (Geolocation, IP address, Browser and operating system, Browsing behavior, and Client ID cookie). These accompany the Web Pixel (write_pixels). They are declared automatically by Shopify for any app that uses a web pixel and are not data that Pandectes explicitly requests or collects for its own purposes.


Under Staff and contributors, Shopify lists data relating to the store owner and blog contributors (such as name, email address, and IP address). These entries are added automatically by Shopify for every app and are not specific to Pandectes.


Quick reference


Permission

Type

Primarily used by

write_privacy_settings

Write (read + write)

Cookie banner: regional consent rules

write_pixels

Write

Consent signals across the customer journey (e.g. Google Consent Mode)

write_content

Write

Creating the pages that host the app's blocks

write_files

Write

Hosting banner/widget logos and the auto-blocker rules file on Shopify's CDN

write_themes

Write (mostly read)

Detecting app-embed status; cleaning up legacy theme assets

write_script_tags

Write

Legacy-theme support and migration cleanup to app embeds

read_customers

Read

Data Subject Requests: email lookup

read_orders

Read

EU Withdrawal Button: order verification

read_all_orders

Read

EU Withdrawal Button: verifying orders older than 60 days

write_metaobject_definitions

Write

Defining the EU Withdrawal record structure

write_metaobjects

Write

Recording withdrawal requests against the order



References and further reading


This section gathers the authoritative sources behind the regulations this app helps you address, together with the official Shopify documentation that governs how the app is installed and what it may access.


Regulatory references



Shopify documentation



Shopify quality programs



This document describes the permissions requested by Pandectes GDPR Compliance and how they are used. If you have questions about any permission, or wish to confirm its usage, you can review the app's management screen in your Shopify admin at any time.

Updated on: 17/06/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!